Bug 1039516 - Add read barrier to SymbolRegistry r=terrence
authorJon Coppeard <jcoppeard@mozilla.com>
Wed, 16 Jul 2014 17:46:03 +0100
changeset 194397 cd712c340dd7b1281860a368345d6b253258ef74
parent 194396 1bb59a022bff644f4965319fb7746b4be460d49e
child 194398 beb84b882a689ed0fc07800afdcf3029f063b913
push id46340
push userjcoppeard@mozilla.com
push dateWed, 16 Jul 2014 16:49:18 +0000
treeherdermozilla-inbound@cd712c340dd7 [default view] [failures only]
perfherder[talos] [build metrics] [platform microbench] (compared to previous push)
reviewersterrence
bugs1039516
milestone33.0a1
first release with
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
last release without
nightly linux32
nightly linux64
nightly mac
nightly win32
nightly win64
Bug 1039516 - Add read barrier to SymbolRegistry r=terrence
js/src/gc/Barrier.h
js/src/jit-test/tests/gc/bug-1039516.js
js/src/vm/Symbol.h
--- a/js/src/gc/Barrier.h
+++ b/js/src/gc/Barrier.h
@@ -838,16 +838,17 @@ typedef ReadBarriered<GlobalObject*> Rea
 typedef ReadBarriered<JSFunction*> ReadBarrieredFunction;
 typedef ReadBarriered<JSObject*> ReadBarrieredObject;
 typedef ReadBarriered<ScriptSourceObject*> ReadBarrieredScriptSourceObject;
 typedef ReadBarriered<Shape*> ReadBarrieredShape;
 typedef ReadBarriered<UnownedBaseShape*> ReadBarrieredUnownedBaseShape;
 typedef ReadBarriered<jit::JitCode*> ReadBarrieredJitCode;
 typedef ReadBarriered<types::TypeObject*> ReadBarrieredTypeObject;
 typedef ReadBarriered<JSAtom*> ReadBarrieredAtom;
+typedef ReadBarriered<JS::Symbol*> ReadBarrieredSymbol;
 
 typedef ReadBarriered<Value> ReadBarrieredValue;
 
 // A pre- and post-barriered Value that is specialized to be aware that it
 // resides in a slots or elements vector. This allows it to be relocated in
 // memory, but with substantially less overhead than a RelocatablePtr.
 class HeapSlot : public BarrieredBase<Value>
 {
new file mode 100644
--- /dev/null
+++ b/js/src/jit-test/tests/gc/bug-1039516.js
@@ -0,0 +1,6 @@
+gczeal(9);
+Symbol.for("a");
+gcslice(1);
+var a = Symbol.for("a");
+gcslice();
+print(Symbol.keyFor(a));
--- a/js/src/vm/Symbol.h
+++ b/js/src/vm/Symbol.h
@@ -78,17 +78,17 @@ struct HashSymbolsByDescription
 };
 
 /*
  * Hash table that implements the symbol registry.
  *
  * This must be a typedef for the benefit of GCC 4.4.6 (used to build B2G for Ice
  * Cream Sandwich).
  */
-typedef HashSet<JS::Symbol *, HashSymbolsByDescription, SystemAllocPolicy> SymbolHashSet;
+typedef HashSet<ReadBarrieredSymbol, HashSymbolsByDescription, SystemAllocPolicy> SymbolHashSet;
 
 /*
  * The runtime-wide symbol registry, used to implement Symbol.for().
  *
  * ES6 draft rev 25 (2014 May 22) calls this the GlobalSymbolRegistry List. In
  * our implementation, it is not global. There is one per JSRuntime. The
  * symbols in the symbol registry, like all symbols, are allocated in the atoms
  * compartment and can be directly referenced from any compartment. They are